Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-39170

Date: September 1, 2021

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually.

Language: PHP

Severity Score

Related Resources (10)

https://github.com/pimcore/pimcore/pull/10178
https://github.com/pimcore/pimcore/pull/10178.patch
https://huntr.dev/bounties/e4cb9cd8-89cf-427c-8d2e-37ca40099bf2/
https://github.com/pimcore/pimcore/pull/10206
https://nvd.nist.gov/vuln/detail/CVE-2021-39170
https://huntr.dev/bounties/c3e4cf79-a4b5-4982-af27-729f66281501
https://huntr.dev/bounties/e4cb9cd8-89cf-427c-8d2e-37ca40099bf2
https://github.com/pimcore/pimcore/security/advisories/GHSA-2v88-qq7x-xq5f
https://github.com/pimcore/pimcore
https://www.mend.io/vulnerability-database/CVE-2021-39170

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Improper Encoding or Escaping of Output

CWE-116

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): SINGLE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us